Skip to navigation

Security Advisory perl security update

Advisory: RHSA-2005:103-04
Type: Security Advisory
Severity: Important
Issued on: 2005-02-15
Last updated on: 2005-02-15
Affected Products: Red Hat Desktop (v. 4)
Red Hat Enterprise Linux AS (v. 4)
Red Hat Enterprise Linux ES (v. 4)
Red Hat Enterprise Linux WS (v. 4)
CVEs (cve.mitre.org): CVE-2004-0452
CVE-2005-0155
CVE-2005-0156

Details

Updated Perl packages that fix several security issues are now available
for Red Hat Enterprise Linux 4.

This update has been rated as having important security impact by the Red
Hat Security Response Team

Perl is a high-level programming language commonly used for system
administration utilities and Web programming.

Kevin Finisterre discovered a stack based buffer overflow flaw in sperl,
the Perl setuid wrapper. A local user could create a sperl executable
script with a carefully created path name, overflowing the buffer and
leading to root privilege escalation. The Common Vulnerabilities and
Exposures project (cve.mitre.org) has assigned the name CAN-2005-0156 to
this issue.

Kevin Finisterre discovered a flaw in sperl which can cause debugging
information to be logged to arbitrary files. By setting an environment
variable, a local user could cause sperl to create, as root, files with
arbitrary filenames, or append the debugging information to existing files.
The Common Vulnerabilities and Exposures project (cve.mitre.org) has
assigned the name CAN-2005-0155 to this issue.

An unsafe file permission bug was discovered in the rmtree() function in
the File::Path module. The rmtree() function removes files and directories
in an insecure manner, which could allow a local user to read or delete
arbitrary files. The Common Vulnerabilities and Exposures project
(cve.mitre.org) has assigned the name CAN-2004-0452 to this issue.

Users of Perl are advised to upgrade to this updated package, which
contains backported patches to correct these issues.


Solution

Before applying this update, make sure that all previously-released
errata relevant to your system have been applied. Use Red Hat
Network to download and update your packages. To launch the Red Hat
Update Agent, use the following command:

up2date

For information on how to install packages manually, refer to the
following Web page for the System Administration or Customization
guide specific to your system:

http://www.redhat.com/docs/manuals/enterprise/

Updated packages

Red Hat Desktop (v. 4)

IA-32:
perl-5.8.5-12.1.i386.rpm
File outdated by:  RHSA-2011:1797
    MD5: 54b5fa19cb57d751ab97f6af23aaa2c8
perl-suidperl-5.8.5-12.1.1.i386.rpm
File outdated by:  RHSA-2011:1797
    MD5: 1c2bea7fbcc7314a8d4ef6e1b6740612
 
x86_64:
perl-5.8.5-12.1.x86_64.rpm
File outdated by:  RHSA-2011:1797
    MD5: 935d0324608cb6929e2cab7a18f0e100
perl-suidperl-5.8.5-12.1.1.x86_64.rpm
File outdated by:  RHSA-2011:1797
    MD5: d9371f44f8d263d1fabe88d55509c43b
 
Red Hat Enterprise Linux AS (v. 4)

IA-32:
perl-5.8.5-12.1.i386.rpm
File outdated by:  RHSA-2011:1797
    MD5: 54b5fa19cb57d751ab97f6af23aaa2c8
perl-suidperl-5.8.5-12.1.1.i386.rpm
File outdated by:  RHSA-2011:1797
    MD5: 1c2bea7fbcc7314a8d4ef6e1b6740612
 
IA-64:
perl-5.8.5-12.1.ia64.rpm
File outdated by:  RHSA-2011:1797
    MD5: f62cd1880ef37655fc3f899167506210
perl-suidperl-5.8.5-12.1.1.ia64.rpm
File outdated by:  RHSA-2011:1797
    MD5: f44de9b35fbea3e3008a54af398f9f85
 
PPC:
perl-5.8.5-12.1.ppc.rpm
File outdated by:  RHSA-2011:1797
    MD5: b6f57d5e260d76af9545746834ca11b8
perl-suidperl-5.8.5-12.1.1.ppc.rpm
File outdated by:  RHSA-2011:1797
    MD5: 1f1ca5442c04035daa6d3ca39a3aec46
 
s390:
perl-5.8.5-12.1.s390.rpm
File outdated by:  RHSA-2011:1797
    MD5: bd38a15ca6df61c3dccfd36b04ba6726
perl-suidperl-5.8.5-12.1.1.s390.rpm
File outdated by:  RHSA-2011:1797
    MD5: 8cf6fe94b55cc0f549d090eff2011636
 
s390x:
perl-5.8.5-12.1.s390x.rpm
File outdated by:  RHSA-2011:1797
    MD5: cc5cf1b33baa869bf1ee4e23e0cc7b35
perl-suidperl-5.8.5-12.1.1.s390x.rpm
File outdated by:  RHSA-2011:1797
    MD5: 9f84a323e964c3a451768b739e548fec
 
x86_64:
perl-5.8.5-12.1.x86_64.rpm
File outdated by:  RHSA-2011:1797
    MD5: 935d0324608cb6929e2cab7a18f0e100
perl-suidperl-5.8.5-12.1.1.x86_64.rpm
File outdated by:  RHSA-2011:1797
    MD5: d9371f44f8d263d1fabe88d55509c43b
 
Red Hat Enterprise Linux ES (v. 4)

IA-32:
perl-5.8.5-12.1.i386.rpm
File outdated by:  RHSA-2011:1797
    MD5: 54b5fa19cb57d751ab97f6af23aaa2c8
perl-suidperl-5.8.5-12.1.1.i386.rpm
File outdated by:  RHSA-2011:1797
    MD5: 1c2bea7fbcc7314a8d4ef6e1b6740612
 
IA-64:
perl-5.8.5-12.1.ia64.rpm
File outdated by:  RHSA-2011:1797
    MD5: f62cd1880ef37655fc3f899167506210
perl-suidperl-5.8.5-12.1.1.ia64.rpm
File outdated by:  RHSA-2011:1797
    MD5: f44de9b35fbea3e3008a54af398f9f85
 
x86_64:
perl-5.8.5-12.1.x86_64.rpm
File outdated by:  RHSA-2011:1797
    MD5: 935d0324608cb6929e2cab7a18f0e100
perl-suidperl-5.8.5-12.1.1.x86_64.rpm
File outdated by:  RHSA-2011:1797
    MD5: d9371f44f8d263d1fabe88d55509c43b
 
Red Hat Enterprise Linux WS (v. 4)

IA-32:
perl-5.8.5-12.1.i386.rpm
File outdated by:  RHSA-2011:1797
    MD5: 54b5fa19cb57d751ab97f6af23aaa2c8
perl-suidperl-5.8.5-12.1.1.i386.rpm
File outdated by:  RHSA-2011:1797
    MD5: 1c2bea7fbcc7314a8d4ef6e1b6740612
 
IA-64:
perl-5.8.5-12.1.ia64.rpm
File outdated by:  RHSA-2011:1797
    MD5: f62cd1880ef37655fc3f899167506210
perl-suidperl-5.8.5-12.1.1.ia64.rpm
File outdated by:  RHSA-2011:1797
    MD5: f44de9b35fbea3e3008a54af398f9f85
 
x86_64:
perl-5.8.5-12.1.x86_64.rpm
File outdated by:  RHSA-2011:1797
    MD5: 935d0324608cb6929e2cab7a18f0e100
perl-suidperl-5.8.5-12.1.1.x86_64.rpm
File outdated by:  RHSA-2011:1797
    MD5: d9371f44f8d263d1fabe88d55509c43b
 
(The unlinked packages above are only available from the Red Hat Network)

Bugs fixed (see bugzilla for more information)

146739 - CAN-2005-0155 multiple setuid perl issues (CAN-2005-0156 )
146774 - CAN-2004-0452 File::Path::rmtree() issue


References



These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/